Read the docs
TI-2017-01067 Aliases CVE-2017-1304GHSA-mhfw-47p6-9px9

Memory corruption in IBM Elastic Storage Server

Priority LOW 28CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

IBM has identified a vulnerability with IBM Spectrum Scale/GPFS utilized on the Elastic Storage Server (ESS)/GPFS Storage Server (GSS) during testing of an unsupported configuration, where users applications are running on an active ESS I/O server node and utilize direct I/O to perform a read or a write to a Spectrum Scale file. This vulnerability may result in the use of an incorrect memory address, leading to a Spectrum Scale/GPFS daemon failure with a Signal 11, and possibly leading to denial of service or undetected data corruption. IBM X-Force ID: 125458.

Why it matters now

EPSS 0.00373 31st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMElastic Storage Server2.0; 2.5; 3.0; 3.5; 4.0; 4.5; 5.0—No fix listedCNA
  • Elastic Storage Server VendorIBM Affected 2.0; 2.5; 3.0; 3.5; 4.0; 4.5; 5.0 Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:ibm:elastic_storage_server:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:2.5.0:*:*:*:*:*:*:*2.5.0VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:2.5.5:*:*:*:*:*:*:*2.5.5VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:3.5.0:*:*:*:*:*:*:*3.5.0VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:3.5.6:*:*:*:*:*:*:*3.5.6VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:4.0.0:*:*:*:*:*:*:*4.0.0VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:4.0.6:*:*:*:*:*:*:*4.0.6VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:4.5.0:*:*:*:*:*:*:*4.5.0VulnerableIBM
  • cpe:2.3:a:ibm:elastic_storage_server:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:2.5.5:*:*:*:*:*:*:* Versions 2.5.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:3.5.0:*:*:*:*:*:*:* Versions 3.5.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:3.5.6:*:*:*:*:*:*:* Versions 3.5.6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:4.0.6:*:*:*:*:*:*:* Versions 4.0.6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·IBM
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ibm:elastic_storage_server:4.6.0:*:*:*:*:*:*:*4.6.0VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableIBM
cpe:2.3:a:ibm:elastic_storage_server:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableIBM
  • cpe:2.3:a:ibm:elastic_storage_server:4.6.0:*:*:*:*:*:*:* Versions 4.6.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:elastic_storage_server:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-1304
  2. 2026-10-03 Alias added: GHSA-mhfw-47p6-9px9

References

Advisory 1

  • TI-2020-04208 IBM Elastic Storage System 6.0.0 through 6.0.1.2 and IBM Elastic Storage Server 5.3.0… CVSS 3.1HIGH 7.5
  • TI-2016-00347 IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and… CVSS 3.0HIGH 8.4
  • TI-2020-03769 IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an… CVSS 3.1MEDIUM 6.5
  • TI-2020-03767 IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an… CVSS 3.1MEDIUM 6.5
  • TI-2020-04031 IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as… CVSS 3.1MEDIUM 5.5
  • TI-2020-03768 IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences